[Hitokage]

Typing this out for my friend who cannot access the internet through her computer at the moment. She has a virus that randomly appeared on her computer today. Here's the current symptoms:

Blocking access to her wireless card
Hugely annoying pop-ups all over her screen
Screwing with her attempts to get rid of it via spybot/anti-virus
Calls itself 'Cloud Protection'.
Did a fake BSoD and reboot once while trying to use spybot.

Any suggestions on where to start? Thanks.

[Essexboy]

Yep - first we will need to protect your system as I will be asking you to transfer files across using a USB drive

On the clean computer download and run Panda Vaccinate ensure that the USB drive you are going to is is vaccinated as well

Download the following programmes to the USB drive and transfer to the sick machine then run following the instructions

Download RogueKiller to your desktop

• Quit all running programs
  
• For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  
• When prompted, type 2 and validate
  
• The RKreport.txt shall be generated next to the executable.
  
• If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next Reply.

THEN

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Select All Users
  
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  CREATERESTOREPOINT
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post both logs

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.